CVE-2026-34204 MinIO is Vulnerable to SSE Metadata Injection via Replication Headers
Authenticated users can inject server-side encryption metadata via replication headers, bypassing intended security controls in MinIO object storage.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-34204?
CVE-2026-34204 is a high-severity missing authorization vulnerability in minio, published on 31 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
MinIO is a high-performance object storage system. Prior to version RELEASE.2026-03-26T21-24-40Z, a flaw in extractMetadataFromMime() allows any authenticated user with s3:PutObject permission to inject internal server-side encryption metadata into objects by sending crafted X-Minio-Replication-* headers on a normal PutObject request. This issue has been patched in version RELEASE.2026-03-26T21-24-40Z.
Weakness: CWE-287
Which versions are affected by CVE-2026-34204?
3 open source packages ship an affected version, including github.com/minio/minio. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/minio/minio Go | From 0.0.0-20240328174456-468a9fae83e9 | None |
github.com/minio/minio Go | From 0.0.0-20240328174456-468a9fae83e9 to 0.0.0-20260212201848-7aac2a2c5b7c | None |
github.com/minio/minio Go | From 0.0.0-20240328174456-468a9fae83e9 to 0.0.0-20260212201848-7aac2a2c5b7c | None |
Products include Minio Minio.
How do I fix CVE-2026-34204?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-34204 being exploited?
There is no known exploitation of CVE-2026-34204 in the wild and no public exploit code.
Other vulnerabilities in minio
Sources
Also known as GHSA-3rh2-v3gr-35p9, GO-2026-4896, MINI-8666-286m-47gj, MINI-c6p4-3gv7-fg4h.